ralph

Ralph Claude Code 向け Ralph Wiggum 自律ループ手法の動作する実装です。 背景 Anthropic のプラグインマーケットプレイスにある公式 ralph-wiggum プラグインは、Claude Code v1.0.20（2025年8月）のセキュリティアップデートにより現在動作していません。 セキュリティパッチ（CVE-2025-54795）は、コマンドインジェクション攻撃を防ぐため、$ コマンド置換と複数行の bash コマンドを正しくブロックします。しかし、公式プラグインのコマンドファイルには、この保護を発動させる複数行の bash が含まれています：...

CVE-2025-54795

Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code...

CVE-2025-54795 Claude Code echo command allowed bypass of user approval prompt for command execution

Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code...

CVE-2025-54795

CVE-2025-54795 affects Claude Code. Multiple connected sources confirm a command parsing error in versions below 1.0.20 that can bypass the in-application confirmation prompt and trigger execution of untrusted commands when attack content is fed into the Claude Code context window. Impacted data/...

locadex (0.0.2-alpha.1) potentially affected by CVE-2025-54795 via @anthropic-ai/claude-code (1.0.8)

@anthropic-ai/claude-code NPM version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on @anthropic-ai/claude-code and may be impacted: - locadex 0.0.2-alpha.1 Source cves: CVE-2025-54795 Source advisory: OSV:GHSA-X56V-X2H6-7J34...